CVE inside.
(cherry picked from commit c1a7d8e396f7ece5e90309b0c460911f7a8ed37f)
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>